Read the docs
TI-2026-00400 Aliases CVE-2026-0599GHSA-j7x9-7j54-2v3h

Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET request, reading the entire response body into memory and cloning it before decoding. This behavior can lead to resource exhaustion, including network bandwidth saturation, memory inflation, and CPU overutilization. The vulnerability is triggered even if the request is later rejected for exceeding token limits. The default deployment configuration, which lacks memory usage limits and authentication, exacerbates the impact, potentially crashing the host machine. The issue is resolved in version 3.3.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.29492 98th percentileScored 2026-11-07
Fix Fixed huggingface/text-generation-inference (huggingface): 3.3.7text-generation (PyPI): 3.3.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfacehuggingface/text-generation-inferencebefore 3.3.73.3.7Patch availableCNA
—text-generation (PyPI)before 3.3.73.3.7Patch availableGHSA-j7x9-7j54-2v3h
  • huggingface/text-generation-inference Vendorhuggingface Affected before 3.3.7 Fixed in 3.3.7 Patch available CNA
  • text-generation (PyPI) Vendor— Affected before 3.3.7 Fixed in 3.3.7 Patch available GHSA-j7x9-7j54-2v3h

Remediation

  • Fix · CNA huggingface/text-generation-inference (huggingface) Fixed in 3.3.7
  • Fix · GHSA-j7x9-7j54-2v3h text-generation (PyPI) Fixed in 3.3.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0599
  2. 2026-10-03 Alias added: GHSA-j7x9-7j54-2v3h

References

Advisory 1

Other 3

  • TI-2026-48351 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVSS 4.0CRITICAL 9.3
  • TI-2026-20914 LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVSS 4.0CRITICAL 9.3
  • TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
  • TI-2025-04589 Sandbox Escape Vulnerability in huggingface/smolagents CVSS 3.1CRITICAL 10.0
  • TI-2026-79938 Pickle deserialization in Hugging Face Datasets allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences